Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There is no chance of an internal attack, so I would like to give sudo privileges to users at the local computer using sudoers. I tried these lines separately:

%admin localhost=(ALL) NOPASSWD: ALL
%admin 127.0.0.1=(ALL) NOPASSWD: ALL

But sudoers does not seem recognize either localhost or 127.0.0.1.

Is there an alternative, and if so, how secure would it be? Could a remote attacker gain local user privileges using cron or some other method?

share|improve this question

migrated from stackoverflow.com Jul 29 '10 at 11:14

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer

up vote 3 down vote accepted

%admin ALL=(ALL) NOPASSWD: ALL

The host list restricts the sudo rule to hosts on which one network interface has a name or address in the list. Since every host has a loopback interface, every host should match your rule; in fact, sudo skips the loopback interface when checking host lists, so no host does match your rule; either way specifying the host as localhost is not useful.

Sudo doesn't do any network authentication: the host list is there so that you can deploy a single sudoers file on multiple machines and give users different permissions on different machines.

Cron also doesn't do any network authentication. A remote user would gain user privileges through a misconfigured or vulnerable network server or client (http, ftp, samba, nfs, snmp, ssh, …).

share|improve this answer
    
"Since every host has a loopback interface, every host matches your rule." Are you sure that's correct? Neither localhost nor 127.0.0.1 seem to match the local computer. –  Josh Jul 29 '10 at 20:56
    
@Josh: that's the documented behavior. In fact sudo skips the loopback interface when checking whether the host is in the list. I've updated my answer to reflect this. Either way, specifying localhost in the host list is not useful. –  Gilles Jul 29 '10 at 21:25
    
Every host would match your rule, if the sudo system allowed it. –  bukzor Apr 2 '13 at 17:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.